- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
Network World - More than half of the Internet’s name servers are configured incorrectly, leaving networks vulnerable to pharming attacks and enabling servers to be used in attacks that can wipe out DNS infrastructure.
This is the key finding of a survey of the Internet’s domain name servers released Monday. The Measurement Factory conducted the survey for Infoblox, which sells DNS appliances.
Overall, the 2006 DNS Report Card assigned a grade of D+ for DNS security. This is the second annual survey conducted by The Measurement Factory about the state of the global DNS.
We saw an increase in the pace and severity of attacks and outages resulting from bad configurations in the DNS infrastructure,’’ says Rick Kagan, vice president of marketing for Infoblox.
The survey’s main finding was that more than half of the Internet’s name servers allow recursive name services. This is a form of name resolution that often requires a name server to relay requests to other name servers.
Infoblox says that allowing recursive name services leaves networks vulnerable to cache poisoning attacks, in which users are redirected to a different Web site often for the purpose of capturing personal information.
"There is no need for servers to support recursive name services,’’ Kagan says. "The problem is that BIND 9 enables recursive name services by default…This is a bad vulnerability. It has been exploited; there are public examples where that has happened. But it’s easy to fix and people should address it.’’
Another DNS configuration problem that the survey found is that 29% of DNS servers allow zone transfers to arbitrary requesters. Zone transfers copy DNS data from one server to another, and leave servers open to denial-of-service attacks.
The survey’s other findings were:
Read more about data center in Network World's Data Center section.